fix: harden operations and configuration recovery

internal/operationlock/lock.go

@@ -13,6 +13,10 @@ import (
 	"proxyctl/internal/securefs"
 )
 
+type Locker interface {
+	Lock(context.Context) (func(), error)
+}
+
 type Lock struct {
 	path  string
 	uid   int
@@ -20,6 +24,29 @@ type Lock struct {
 	owned bool
 }
 
+type Group struct{ locks []Locker }
+
+func NewGroup(locks ...Locker) *Group { return &Group{locks: append([]Locker(nil), locks...)} }
+
+func (g *Group) Lock(ctx context.Context) (func(), error) {
+	var unlocks []func()
+	for _, lock := range g.locks {
+		unlock, err := lock.Lock(ctx)
+		if err != nil {
+			for i := len(unlocks) - 1; i >= 0; i-- {
+				unlocks[i]()
+			}
+			return nil, err
+		}
+		unlocks = append(unlocks, unlock)
+	}
+	return func() {
+		for i := len(unlocks) - 1; i >= 0; i-- {
+			unlocks[i]()
+		}
+	}, nil
+}
+
 func New(path string) *Lock { return &Lock{path: path} }
 func NewOwned(path string, uid, gid int) *Lock {
 	return &Lock{path: path, uid: uid, gid: gid, owned: true}